Privacy Policy

1. Information We Collect

A. Information you provide to us

• Account and profile data: name, email address, phone number, delivery addresses, password, language preferences, and profile settings.
• Waitlist and inquiry data: if you join our waitlist or contact us as a prospective customer, merchant partner, or investor, the contact and business information you submit.
• Order data: items purchased, order history, dietary or preference selections you choose to save, replacement preferences, delivery instructions, tips, and communications with merchants, shoppers, delivery drivers, couriers, or support.
• Payment data: payment card details are collected and processed by our PCI-DSS-compliant payment processor, Stripe. VORA receives limited data such as card brand, last four digits, and transaction status. We do not store full card numbers.
• Communications: messages, reviews, ratings, survey responses, and support conversations, including in-app chat between you and your shopper or driver about an order.
• Merchant and courier data: business name, tax information (e.g., Form W-9), licenses and permits, bank payout details (collected via Stripe), and identity-verification information, where applicable.
• Referral program data: if you take part in our merchant referral program, the referrals you make and the payout and tax details we need to pay any reward.

B. Information collected automatically

• Device and usage data: IP address, device identifiers, browser and operating-system type, app version, pages viewed, features used, referring URLs, and crash logs.
• Location data (consumers): approximate location derived from your IP address; precise geolocation from your device only if you grant permission (used for delivery addresses, ETAs, and service-area checks). You can disable precise location at any time in your device settings.
• Order-fulfillment records: store receipts for VORA Shopper orders (photographed or scanned by VORA's shopper), item-replacement decisions, delivery-verification records, and timestamps. Delivery-verification records include photographs taken by a courier or delivery person at the drop-off point, entry of a delivery PIN, delivery-location coordinates, and records of the notification, message, or call attempts made to reach you at delivery. A drop-off photograph shows the location where your order was left; we ask couriers not to photograph people. See Section 4 for how long we keep these records.
• Cookies and similar technologies: we use strictly necessary cookies and a privacy-focused, cookieless analytics service. We do not use third-party advertising or targeting cookies. See our Cookie Policy.
• Referral attribution: if you arrive through a merchant's referral link, we store that referral code in your browser as first-party storage for up to 90 days so the merchant who referred you is credited when you apply. It is not shared with third parties or used for advertising. See our Cookie Policy.

C. Information from other sources

• Merchants and couriers: order status, delivery confirmations, and fulfillment details.
• Service providers: fraud-prevention, payment, and identity-verification signals from our payment processor and security vendors.
• Publicly available sources, where lawful (for example, verifying a merchant's business license status).

2. How We Use Personal Information

• Provide, operate, and improve the Platform, including processing orders, payments, shopping trips, deliveries, refunds, price adjustments, and support;
• Connect you with merchants and couriers, and share with our own shopping and delivery personnel the information needed to fulfill your orders;
• Personalize your experience, including culturally relevant product discovery and recommendations;
• Communicate with you about your orders and account (transactional messages), and, with your consent where required by law, send marketing communications, which you can opt out of at any time;
• Conduct analytics, research, and product development, including improving our logistics, routing, forecasting, and discovery systems, using de-identified or aggregated data where feasible;
• Confirm that an order was delivered, and evaluate refund requests, delivery disputes, and payment disputes (chargebacks), including by reference to delivery-verification records;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• Comply with legal obligations (tax, accounting, insurance, food-safety cooperation, lawful requests); and
• Protect the rights, safety, and property of VORA, our users, merchants, couriers, and the public.

3. How We Disclose Personal Information

• Merchants and couriers, to fulfill your orders (e.g., your first name, order contents, delivery address and instructions). For VORA Shopper orders, your order, replacement preferences, and delivery details are used by VORA's own personnel and are not shared with the retail store;
• Service providers acting on our behalf under contract, such as payment processing (Stripe), identity-verification providers, insurance carriers where a claim requires it, cloud hosting, analytics, mapping and navigation, communications and customer-support tools, and fraud prevention, who may use the information only to provide services to us;
• Corporate transactions: in connection with a merger, financing, acquisition, or sale of assets, subject to standard safeguards;
• Legal and safety: to comply with law, respond to lawful requests, enforce our Terms, or protect rights, safety, and property; and
• With your direction or consent.

4. Data Retention

We retain personal information for as long as needed for the purposes described above, including to maintain your account, comply with legal obligations (e.g., tax and transaction records), resolve disputes, and enforce agreements. Retention periods vary by data type; when data is no longer needed, we delete or de-identify it. Order, receipt, and payment records are typically retained for the period required by tax and accounting law. Delivery-verification records, including drop-off photographs, PIN-entry records, delivery coordinates, and contact-attempt logs, are retained for up to 18 months so that we can resolve delivery disputes and respond to payment disputes, which your bank or card network may allow you to raise months after an order.

5. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No system is completely secure; please protect your account credentials and notify us of any suspected unauthorized access. In the event of a data breach affecting your personal information, we will notify you and regulators as required by applicable law, including Florida's Information Protection Act (Fla. Stat. § 501.171).

6. Your Privacy Rights and Choices

A. Choices available to everyone

• Marketing opt-out: use the unsubscribe link in any marketing email or reply STOP to any marketing text; transactional messages about your orders will continue.
• Push notifications and precise location: manage these in your device settings.
• Account information: review and update your profile in the app, or contact us.

B. U.S. state privacy rights

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Texas, Oregon, and others), and subject to applicable thresholds and exemptions, you may have the right to:

• Know / access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your personal information;
• Portability: obtain a copy in a usable format;
• Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling, noting that VORA does not currently sell or share personal information or engage in such advertising or profiling; and
• Limit the use of sensitive personal information, noting that we do not use or disclose sensitive personal information for purposes that would trigger this right.

We will not discriminate against you for exercising any of these rights.

How to submit a request. Email privacy@tryvora.app from the email address associated with your account (or include enough information for us to verify your identity, such as your name and the phone number or addresses on your account). We will verify your identity, respond within the time required by law (generally 45 days, extendable with notice), and explain the basis for any denial. Appeals: if we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General. Authorized agents: you may use an authorized agent to submit requests on your behalf with proof of authorization.

C. California notice at collection (CCPA/CPRA)

For California residents: we collect the categories of personal information described in Section 1: identifiers; customer records; commercial information; internet or other electronic network activity; geolocation data; audio/electronic/visual information (support communications, receipt photos, and drop-off delivery photographs); and professional information for merchant and courier contacts. The sources, purposes, and disclosure categories are described in Sections 1–3, and retention in Section 4. In the preceding 12 months, we have not sold personal information and have not shared personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes requiring a "Right to Limit" notice. We disclose personal information to service providers for business purposes as described in Section 3.

7. Children's Privacy

The Platform is intended for adults 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at privacy@tryvora.app and we will delete it as required by COPPA and applicable law.

8. Third-Party Links and Services

The Platform may contain links to third-party sites and services (including merchant sites and Stripe's payment interface). Their privacy practices are governed by their own policies. Retail stores where VORA Shoppers purchase items on your behalf are independent businesses; they receive no personal information about you from VORA; the shopper purchases as an ordinary in-store customer.

9. International Users and Data Transfers

The Platform is operated from the United States and is currently intended for U.S. users. If you access the Platform from outside the U.S., you understand your information will be processed in the United States. If we expand to other countries in the future, we will provide region-specific privacy disclosures and implement lawful transfer mechanisms as required by the laws of those regions.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Effective" date and, for material changes, provide additional notice (such as email or in-app notice). Your continued use after the effective date constitutes acknowledgment of the updated Policy.

11. Contact Us